From 9745a335380cfd90dcb49c692339895cd5dc5c8d Mon Sep 17 00:00:00 2001
From: fengyubiao <yubiao.feng@streamnative.io>
Date: Thu, 9 Mar 2023 18:17:54 +0800
Subject: [PATCH 1/6] [cleanup] [broker] cleanup the lib which may lead to the
 OWASP Dependency Check fail

---
 pom.xml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pom.xml b/pom.xml
index 5b001f2d3f610..0ca60b4ae61fa 100644
--- a/pom.xml
+++ b/pom.xml
@@ -878,6 +878,12 @@ flexible messaging model and an intuitive client API.</description>
         <version>${caffeine.version}</version>
       </dependency>
 
+      <dependency>
+        <groupId>org.bouncycastle</groupId>
+        <artifactId>bcpkix-jdk15on</artifactId>
+        <version>${bouncycastle.version}</version>
+      </dependency>
+
       <dependency>
         <groupId>com.yahoo.athenz</groupId>
         <artifactId>athenz-zts-java-client-core</artifactId>

From f7863d8e9b55c0336fb71db7cb30d1b72ab8f51b Mon Sep 17 00:00:00 2001
From: fengyubiao <yubiao.feng@streamnative.io>
Date: Thu, 9 Mar 2023 22:47:06 +0800
Subject: [PATCH 2/6] CVE

---
 pom.xml | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 0ca60b4ae61fa..9d5059329645d 100644
--- a/pom.xml
+++ b/pom.xml
@@ -291,7 +291,7 @@ flexible messaging model and an intuitive client API.</description>
     <errorprone-slf4j.version>0.1.4</errorprone-slf4j.version>
     <j2objc-annotations.version>1.3</j2objc-annotations.version>
     <lightproto-maven-plugin.version>0.4</lightproto-maven-plugin.version>
-    <dependency-check-maven.version>8.0.1</dependency-check-maven.version>
+    <dependency-check-maven.version>8.1.2</dependency-check-maven.version>
     <roaringbitmap.version>0.9.15</roaringbitmap.version>
     <extra-enforcer-rules.version>1.6.1</extra-enforcer-rules.version>
     <oshi.version>6.4.0</oshi.version>
@@ -884,6 +884,18 @@ flexible messaging model and an intuitive client API.</description>
         <version>${bouncycastle.version}</version>
       </dependency>
 
+      <dependency>
+        <groupId>com.cronutils</groupId>
+        <artifactId>cron-utils</artifactId>
+        <version>${cron-utils.version}</version>
+        <exclusions>
+          <exclusion>
+            <groupId>org.glassfish</groupId>
+            <artifactId>javax.el</artifactId>
+          </exclusion>
+        </exclusions>
+      </dependency>
+
       <dependency>
         <groupId>com.yahoo.athenz</groupId>
         <artifactId>athenz-zts-java-client-core</artifactId>

From 6ed43ac2815533f6af40833c8858083c9e07bbf7 Mon Sep 17 00:00:00 2001
From: fengyubiao <yubiao.feng@streamnative.io>
Date: Thu, 9 Mar 2023 22:57:24 +0800
Subject: [PATCH 3/6] CVE

---
 pom.xml | 13 ++++---------
 1 file changed, 4 insertions(+), 9 deletions(-)

diff --git a/pom.xml b/pom.xml
index 9d5059329645d..3849e279bf7ee 100644
--- a/pom.xml
+++ b/pom.xml
@@ -226,6 +226,7 @@ flexible messaging model and an intuitive client API.</description>
     <jna.version>5.12.1</jna.version>
     <kubernetesclient.version>12.0.1</kubernetesclient.version>
     <okhttp3.version>4.9.3</okhttp3.version>
+    <javax.el.version>3.0.4</javax.el.version>
     <!-- use okio version that matches the okhttp3 version -->
     <okio.version>2.8.0</okio.version>
     <!-- override kotlin-stdlib used by okio in order to address CVE-2020-29582 -->
@@ -885,15 +886,9 @@ flexible messaging model and an intuitive client API.</description>
       </dependency>
 
       <dependency>
-        <groupId>com.cronutils</groupId>
-        <artifactId>cron-utils</artifactId>
-        <version>${cron-utils.version}</version>
-        <exclusions>
-          <exclusion>
-            <groupId>org.glassfish</groupId>
-            <artifactId>javax.el</artifactId>
-          </exclusion>
-        </exclusions>
+        <groupId>org.glassfish</groupId>
+        <artifactId>javax.el</artifactId>
+        <version>${javax.el.version}</version>
       </dependency>
 
       <dependency>

From 01a7e05c681065232bc947b87008d7da6ac98966 Mon Sep 17 00:00:00 2001
From: fengyubiao <yubiao.feng@streamnative.io>
Date: Thu, 9 Mar 2023 23:22:34 +0800
Subject: [PATCH 4/6] fix typo

---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 3849e279bf7ee..d25b2f3a7ff5d 100644
--- a/pom.xml
+++ b/pom.xml
@@ -887,7 +887,7 @@ flexible messaging model and an intuitive client API.</description>
 
       <dependency>
         <groupId>org.glassfish</groupId>
-        <artifactId>javax.el</artifactId>
+        <artifactId>jakarta.el</artifactId>
         <version>${javax.el.version}</version>
       </dependency>
 

From 3769aaddef2f3d0bb38bb7cf7c0beb5cab30db20 Mon Sep 17 00:00:00 2001
From: fengyubiao <yubiao.feng@streamnative.io>
Date: Fri, 10 Mar 2023 07:20:43 +0800
Subject: [PATCH 5/6] remove javax.el

---
 pom.xml | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/pom.xml b/pom.xml
index d25b2f3a7ff5d..9d5059329645d 100644
--- a/pom.xml
+++ b/pom.xml
@@ -226,7 +226,6 @@ flexible messaging model and an intuitive client API.</description>
     <jna.version>5.12.1</jna.version>
     <kubernetesclient.version>12.0.1</kubernetesclient.version>
     <okhttp3.version>4.9.3</okhttp3.version>
-    <javax.el.version>3.0.4</javax.el.version>
     <!-- use okio version that matches the okhttp3 version -->
     <okio.version>2.8.0</okio.version>
     <!-- override kotlin-stdlib used by okio in order to address CVE-2020-29582 -->
@@ -886,9 +885,15 @@ flexible messaging model and an intuitive client API.</description>
       </dependency>
 
       <dependency>
-        <groupId>org.glassfish</groupId>
-        <artifactId>jakarta.el</artifactId>
-        <version>${javax.el.version}</version>
+        <groupId>com.cronutils</groupId>
+        <artifactId>cron-utils</artifactId>
+        <version>${cron-utils.version}</version>
+        <exclusions>
+          <exclusion>
+            <groupId>org.glassfish</groupId>
+            <artifactId>javax.el</artifactId>
+          </exclusion>
+        </exclusions>
       </dependency>
 
       <dependency>

From 09819fa3852e9803d5ab5bb24d33454c0d783c75 Mon Sep 17 00:00:00 2001
From: fengyubiao <yubiao.feng@streamnative.io>
Date: Fri, 10 Mar 2023 07:36:16 +0800
Subject: [PATCH 6/6] It treat pulsar-io-kafka-connect-adaptor as a lib of
 Kafka, so remove these check

---
 src/owasp-dependency-check-false-positives.xml | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/src/owasp-dependency-check-false-positives.xml b/src/owasp-dependency-check-false-positives.xml
index 21a3679c0d8f7..345be8f4d2c06 100644
--- a/src/owasp-dependency-check-false-positives.xml
+++ b/src/owasp-dependency-check-false-positives.xml
@@ -182,6 +182,16 @@
     <cve>CVE-2021-4277</cve>
   </suppress>
 
+  <suppress>
+    <notes>It treat pulsar-io-kafka-connect-adaptor as a lib of Kafka, CVE-2021-25194 is a false positive.</notes>
+    <cve>CVE-2023-25194</cve>
+  </suppress>
+
+  <suppress>
+    <notes>It treat pulsar-io-kafka-connect-adaptor as a lib of Kafka, CVE-2021-34917 is a false positive.</notes>
+    <cve>CVE-2022-34917</cve>
+  </suppress>
+
   <suppress>
     <notes>yaml_project is not used at all. Any CVEs reported for yaml_project are false positives.</notes>
     <cpe>cpe:/a:yaml_project:yaml</cpe>